CPUID

The CPUID opcode is a processor supplementary instruction (its name derived from CPU IDentification) for the x86 architecture. It was introduced by Intel in 1993 when it introduced the Pentium and SL-Enhanced 486 processors.^[1]

By using the CPUID opcode, software can determine processor type and the presence of features (like MMX/SSE). The CPUID opcode is 0FA2h and the value in the EAX register specifies what information to return.

Prior to the general availability of the CPUID instruction, programmers would write esoteric machine code which exploited minor differences in CPU behavior in order to determine the processor make and model.^[2][3] Outside the x86 family, developers are still required to use esoteric processes to determine the variations in CPU design are present. The CPUID instruction is simply not found outside of the x86 architecture. The lack of the CPUID instruction applies to RISC, DSP and transputer like CPU architectural families.

Calling CPUID

In assembly language the CPUID instruction takes no parameters as CPUID implicitly uses the EAX register. The EAX register should be loaded with a value specifying what information to return. CPUID should be called with EAX = 0 first, as this will return the highest calling parameter that the CPU supports. To obtain extended function information CPUID should be called with bit 31 of EAX set. To determine the highest extended function calling parameter, call CPUID with EAX = 80000000h.

EAX=0: Get vendor ID

This returns the CPU's manufacturer ID string - a twelve character ASCII string stored in EBX, EDX, ECX - in that order. The highest basic calling parameter is returned in EAX.

The following are known processor manufacturer ID strings:

• "AMDisbetter!" - early engineering samples of AMD K5 processor
• "AuthenticAMD" - AMD
• "CentaurHauls" - Centaur
• "CyrixInstead" - Cyrix
• "GenuineIntel" - Intel
• "TransmetaCPU" - Transmeta
• "GenuineTMx86" - Transmeta
• "Geode by NSC" - National Semiconductor
• "NexGenDriven" - NexGen
• "RiseRiseRise" - Rise
• "SiS SiS SiS " - SiS
• "UMC UMC UMC " - UMC
• "VIA VIA VIA " - VIA

For instance, on a GenuineIntel processor values returned in EBX is 0x756e6547, EDX is 0x49656e69 and ECX is 0x6c65746e. The following code is written in GNU Assembler for the x86-64 architecture and displays the vendor ID string as well as the highest calling parameter that the CPU supports.

.section .data
s0 : .asciz "Largest Standard Function Number Supported: %i\n"
s1 : .asciz "Vendor ID : %.12s\n"
 
.section .text
 
.global _start
.type _start,@function
.align 32
_start:
        pushq   %rbp
        pushq   %rbx
        movq    %rsp, %rbp
        subq    $16,  %rsp
 
        xorl    %eax,        %eax
        cpuid
 
        movl    %ebx,        (%rsp)
        movl    %edx,        4(%rsp)
        movl    %ecx,        8(%rsp)
 
        movq    $s0,   %rdi
        movl    %eax,        %esi
        xorb    %al, %al
        call   printf
 
        movq    $s1,   %rdi
        movq    %rsp, %rsi
        xorb    %al, %al
        call   printf
 
        movq    %rbp, %rsp
        popq    %rbx
        popq    %rbp
        movl    $1, %eax
        int     $0x80

EAX=1: Processor Info and Feature Bits

This returns the CPU's stepping, model, and family information in EAX (also called the signature of a CPU), feature flags in EDX and ECX, and additional feature info in EBX.

The format of the information in EAX is as follows:

• 3:0 - Stepping
• 7:4 - Model
• 11:8 - Family
• 13:12 - Processor Type
• 19:16 - Extended Model
• 27:20 - Extended Family

Intel has suggested applications to display the family of a CPU as the sum of the "Family" and the "Extended Family" fields shown above, and the model as the sum of the "Model" and the 4-bit left-shifted "Extended Model" fields.^[4]

AMD recommends the same only if "Family" is equal to 15 (i.e. all bits set to 1). If "Family" is lower than 15, only the "Family" and "Model" fields should be used while the "Extended Family" and "Extended Model" bits are reserved. If "Family" is set to 15, then "Extended Family" and the 4-bit left-shifted "Extended Model" should be added to the respective base values.^[5]

The processor info and feature flags are manufacturer specific but usually the Intel values are used by other manufacturers for the sake of compatibility.

The standard Intel feature flags are as follows^[6][7]

EAX=1 CPUID feature bits

Bit	EDX		ECX
	Short	Feature	Short	Feature
0	fpu	Onboard x87 FPU	pni	Prescott New Instructions (SSE3)
1	vme	Virtual mode extensions (VIF)	pclmulqdq	PCLMULQDQ support
2	de	Debugging extensions (CR4 bit 3)	dtes64	64-bit debug store (edx bit 21)
3	pse	Page size extensions	monitor	MONITOR and MWAIT instructions (SSE3)
4	tsc	Time Stamp Counter	ds_cpl	CPL qualified debug store
5	msr	Model-specific registers	vmx	Virtual Machine eXtensions
6	pae	Physical Address Extension	smx	Safer Mode Extensions (LaGrande)
7	mce	Machine Check Exception	est	Enhanced SpeedStep
8	cx8	CMPXCHG8 (compare-and-swap) instruction	tm2	Thermal Monitor 2
9	apic	Onboard Advanced Programmable Interrupt Controller	ssse3	Suplemental SSE3 instructions
10	(reserved)		cid	Context ID
11	sep	SYSENTER and SYSEXIT instructions	(reserved)
12	mtrr	Memory Type Range Registers	fma	Fused multiply-add (FMA3)
13	pge	Page Global Enable bit in CR4	cx16	CMPXCHG16B instruction
14	mca	Machine check architecture	xtpr	Can disable sending task priority messages
15	cmov	Conditional move and FCMOV instructions	pdcm	Perfmon & debug capability
16	pat	Page Attribute Table	(reserved)
17	pse36	36-bit page huge pages	pcid	Process context identifiers (CR4 bit 17)
18	pn	Processor Serial Number	dca	Direct cache access for DMA writes[8][9]
19	clflush	CLFLUSH instruction (SSE2)	sse4_1	SSE4.1 instructions
20	(reserved)		sse4_2	SSE4.2 instructions
21	dts	Debug store: save trace of executed jumps	x2apic	x2APIC support
22	acpi	Onboard thermal control MSRs for ACPI	movbe	MOVBE instruction (big-endian, Intel Atom only)
23	mmx	MMX instructions	popcnt	POPCNT instruction
24	fxsr	FXSAVE, FXRESTOR instructions, CR4 bit 9	tscdeadline	APIC supports one-shot operation using a TSC deadline value
25	sse	SSE instructions (a.k.a. Katmai New Instructions)	aes	AES instruction set
26	sse2	SSE2 instructions	xsave	XSAVE, XRESTOR, XSETBV, XGETBV
27	ss	CPU cache supports self-snoop	osxsave	XSAVE enabled by OS
28	ht	Hyper-threading	avx	Advanced Vector Extensions
29	tm	Thermal monitor automatically limits temperature	f16c	CVT16 instruction set (half-precision) FP support
30	ia64	IA64 processor emulating x86	rdrnd	RDRAND (on-chip random number generator) support
31	pbe	Pending Break Enable (PBE# pin) wakeup support	hypervisor	Running on a hypervisor (always 0 on a real CPU)

EAX=2: Cache and TLB Descriptor information

This returns a list of descriptors indicating cache and TLB capabilities in EAX, EBX, ECX and EDX registers.

EAX=3: Processor Serial Number

This returns the processor's serial number. The processor serial number was introduced on Intel Pentium III, but due to privacy concerns, this feature is no longer implemented on later models (PSN feature bit is always cleared). Transmeta's Efficeon and Crusoe processors also provide this feature. AMD CPUs however, do not implement this feature in any CPU models.

For Intel Pentium III CPUs, the serial number is returned in EDX:ECX registers. For Transmeta Efficeon CPUs, it is returned in EBX:EAX registers. And for Transmeta Crusoe CPUs, it is returned in EBX register only.

Note that the processor serial number feature must be enabled in the BIOS setting in order to function.

EAX=80000000h: Get Highest Extended Function Supported

The highest calling parameter is returned in EAX.

EAX=80000001h: Extended Processor Info and Feature Bits

This returns extended feature flags in EDX and ECX.

EAX=80000002h,80000003h,80000004h: Processor Brand String

These return the processor brand string in EAX, EBX, ECX and EDX. CPUID must be issued with each parameter in sequence to get the entire 48-byte null-terminated ASCII processor brand string.^[10] It is necessary to check whether the feature is supported by the CPU by issuing CPUID with EAX = 80000000h first and checking if the returned value is greater or equal to 80000004h.

.section .data
 
s0 : .asciz "Processor Brand String: %.48s\n"
err : .asciz "Feature unsupported.\n"
 
.section .text
 
.global main
.type main,@function
.align 32
main:
        pushq   %rbp
        movq    %rsp, %rbp
        subq    $48,  %rsp
        pushq   %rbx
 
        movl    $0x80000000,  %eax
        cpuid
 
        cmpl    $0x80000004,  %eax
        jl     error
 
        movl    $0x80000002,  %esi
        movq    %rsp, %rdi
 
.align 16
get_brand:
        movl    %esi,        %eax
        cpuid
 
        movl    %eax,        (%rdi)
        movl    %ebx,        4(%rdi)
        movl    %ecx,        8(%rdi)
        movl    %edx,        12(%rdi)
 
        addl    $1,   %esi
        addq    $16,  %rdi
        cmpl    $0x80000004,  %esi
        jle    get_brand
 
print_brand:
        movq    $s0,   %rdi
        movq    %rsp, %rsi
        xorb    %al, %al
        call   printf
 
        jmp    end
 
.align 16
error:
        movq    $err,  %rdi
        xorb    %al, %al
        call   printf
 
.align 16
end:
        popq    %rbx
        movq    %rbp, %rsp
        popq    %rbp
        xorl    %eax,        %eax
        ret

EAX=80000005h: L1 Cache and TLB Identifiers

This function contains the processor’s L1 cache and TLB characteristics.

EAX=80000006h: Extended L2 Cache Features

Returns details of the L2 cache in ECX, including the line size in bytes, type of associativity (encoded by a 4 bits) and the cache size.

.section .data
 
info : .ascii "L2 Cache Size : %u KB\nLine size : %u bytes\n"
.asciz "Associativity : %02xh\n"
err : .asciz "Feature unsupported.\n"
 
.section .text
 
.global main
.type main,@function
.align 32
main:
        pushq   %rbp
        movq    %rsp, %rbp
        pushq   %rbx
 
        movl    $0x80000000,  %eax
        cpuid
 
        cmpl    $0x80000006,  %eax
        jl     error
 
        movl    $0x80000006,  %eax
        cpuid
 
        movl    %ecx,        %eax
 
        movl    %eax,        %edx
        andl    $0xff,        %edx
 
        movl    %eax,        %ecx
        shrl    $12,  %ecx
        andl    $0xf, %ecx
 
        movl    %eax,        %esi
        shrl    $16,  %esi
        andl    $0xffff,%esi
 
        movq    $info, %rdi
        xorb    %al, %al
        call   printf
 
        jmp end
 
.align 16
error:
        movq    $err,  %rdi
        xorb    %al, %al
        call   printf
 
.align 16
end:
        popq    %rbx
        movq    %rbp, %rsp
        popq    %rbp
        xorl    %eax,        %eax
        ret

EAX=80000007h: Advanced Power Management Information

This function provides advanced power management feature identifiers.

EAX=80000008h: Virtual and Physical address Sizes

Returns largest virtual and physical address sizes in EAX.

Accessing the id from other languages

This information is easy to access from other languages as well. For instance, the C++ code for gcc below prints the first five values, returned by the cpuid:

#include <iostream>
 
int main()
{
  int a, b;
 
  for (a = 0; a < 5; a++)
  {
    __asm ( "mov %1, %%eax; "            // a into eax
          "cpuid;"
          "mov %%eax, %0;"             // eax into b
          :"=r"(b)                     // output
          :"r"(a)                      // input
          :"%eax","%ebx","%ecx","%edx" // clobbered register
         );
    std::cout << "The code " << a << " gives " << b << std::endl;
  }
 
  return 0;
}

In C, the code may be shortened to:

int main()
{
  int a, b;
 
  for (a = 0; a < 5; a++)
  {
    __asm( "cpuid"
         : "=a" (b)              // EAX into b (output)
         : "a"  (a)              // a into EAX (input)
         :"%ebx","%ecx","%edx"); // cpuid always clobbers these
 
    printf("The code %i gives %i\n", a, b);
  }
 
  return 0;
}

Or, a generally useful C implementation that works on 32 and 64 bit setups:

#include <stdio.h>
 
void cpuid(unsigned info, unsigned *eax, unsigned *ebx, unsigned *ecx, unsigned *edx)
{
  *eax = info;
  __asm volatile
    ("mov %%ebx, %%edi;" /* 32bit PIC: don't clobber ebx */
     "cpuid;"
     "mov %%ebx, %%esi;"
     "mov %%edi, %%ebx;"
     :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)
     : :"edi");
}
 
int main()
{
  unsigned int eax, ebx, ecx, edx;
  int i;
 
  for (i = 0; i < 6; ++i)
  {
    cpuid(i, &eax, &ebx, &ecx, &edx);
    printf("eax=%i: %#010x %#010x %#010x %#010x\n", i, eax, ebx, ecx, edx);
  }
 
  return 0;
}

Microsoft Visual C compiler has builtin function __cpuid() so cpuid instruction may be embedded without using inline assembly. This is handy since x64 version of MSVC doesn't allow inline assembly at all. The same program for MSVC would be:

#include <iostream>
#include <intrin.h>
 
int main()
{
  int b[4];
 
  for (int a = 0; a < 5; a++)
  {
    __cpuid(b,a);
    std::cout << "The code " << a << " gives " << b[0] << std::endl;
  }
 
  return 0;
}

For Borland/Embarcadero C compilers (bcc32), native asm function calls are necessary, as there is no asm() implementation. The pseudo code:

  unsigned int a, b, c, d;
  unsigned int InfoType = 0;
  __asm xor EBX, EBX;
  __asm xor ECX, ECX;
  __asm xor EDX, EDX;
  __asm mov EAX, InfoType;
  __asm cpuid;
  __asm mov a, EAX;
  __asm mov b, EBX;
  __asm mov c, ECX;
  __asm mov d, EDX;

Uptake of CPUID instructions outside x86

The Intel-AMD x86 family has so far been the only CPU family to have a CPUID instruction. RISC, DSP and transputer like chip families have not taken up the instruction in any noticeable way, in spite of having (in relative terms) as many variations in design.

See also

• Pentium III: Controversy about privacy issues.
• CPU-Z, a Windows utility that uses CPUID to identify various system settings.

References

1. ^ Intel 64 and IA-32 Architectures Software Developer’s Manual
2. ^ Detecting Intel Processors -- Knowing the generation of a system CPU
3. ^ http://lxr.linux.no/source/arch/i386/kernel/head.S?v=1.2.13#L92
4. ^ http://download.intel.com/design/processor/applnots/24161832.pdf
5. ^ http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/25481.pdf
6. ^ , Intel, January 2011, http://www.intel.com/assets/pdf/appnote/241618.pdf, retrieved 2011-05-29 
7. ^ Linux kernel source code arch/x86/include/asm/cpufeatures.h
8. ^ Huggahalli, Ram; Iyer, Ravi; Tetrick, Scott (2005), "Direct cache access for high bandwidth network I/O", Proc. 32nd Ann. Int’l Symp. on Computer Architecture, doi:10.1.1.85.3862, http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.85.3862, retrieved 2011-05-29 
9. ^ Drepper, Ulrich (2007), What Every Programmer Should Know About Memory, http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.91.957, retrieved 2011-05-29 
10. ^ http://download.intel.com/design/processor/applnots/24161832.pdf

External links

• IA-32 architecture CPUID
• CPUID guide:
  • Intel (PDF)
  • AMD (PDF)